Gamma Data Handling

Contents

• Overview

• Prerequisites

• Instructions

• Output

• Error Handling

• Examples

• Resources

Overview

Implement proper data handling, privacy controls, and GDPR/CCPA compliance for Gamma integrations.

Prerequisites

• Understanding of data privacy regulations (GDPR, CCPA)

• Data classification policies defined

• Legal/compliance team consultation

Data Classification

Type Classification Retention Handling

Presentation content User data User-controlled Encrypted at rest

AI-generated text Derived data With source Standard

User prompts PII potential 30 days Anonymize logs

Export files User data 24 hours cache Auto-delete

Instructions

Step 1: Implement Consent Management

Check user consent before Gamma operations. Require explicit consent for data processing and AI analysis separately.

Step 2: Configure PII Handling

Mask emails, hash names, and remove sensitive fields before logging. Never log raw PII in production.

Step 3: Enforce Retention Policies

Auto-delete exports (1 day), anonymize prompts (30 days), archive logs (90 days), delete presentations (365 days). Schedule daily enforcement.

Step 4: Handle GDPR Requests

• Access: Gather all user data including Gamma-stored presentations

• Erasure: Delete from local DB and Gamma API, anonymize user record

Step 5: Enable Audit Trail

Log all significant actions (create, update, delete, share, export) with user ID, IP, timestamp, and resource details.

See detailed implementation for consent management, PII sanitization, retention enforcement, GDPR request handlers, and audit trail code.

Output

• Consent management enforced before operations

• PII sanitized in all logs

• Retention policies running daily

• GDPR access/erasure requests handled

• Audit trail recording all actions

Error Handling

Error Cause Solution

Consent not obtained New user flow Add consent gate before first operation

Deletion incomplete Gamma API timeout Retry with exponential backoff

Audit gap Missing log entry Add audit middleware to all routes

Retention not running Scheduler stopped Monitor cron job health

Examples

Compliance Checklist

• Data processing agreement with Gamma signed

• User consent mechanism implemented

• PII handling procedures documented

• Data retention policies enforced

• GDPR rights request process ready

• Audit logging enabled

Resources

• Gamma Privacy Policy

• Gamma DPA

• GDPR Compliance Guide

Next Steps

Proceed to gamma-enterprise-rbac for access control.